Vulnerability Note VU#748355

ASN.1 parsing errors exist in implementations of SSL, TLS, S/MIME, PKCS#7 routines

Overview

Abstract Syntax Notation number One (ASN.1) is an international standard used to describe and transmit data packets between applications and across networks. There is a vulnerability related to ASN.1 that could permit an attacker to cause a denial of service or potentially execute arbitrary code.

I. Description

The ASN.1 library used by OpenSSL has several parsing errors which allow malformed certificate encodings to be parsed incorrectly. Attackers can exploit this vulnerability remotely to cause a denial of service or potentially execute arbitrary code, depending on the circumstance under which the vulnerable parser is exercised. Routines affected include those supporting SSL and TLS applications, as well as S/MIME (PKCS#7) and certificate creation.

Specifically, the parser implemented in various ASN.1 libraries accepts certain invalidly encoded data (in this case with an invalid length parameter) leading to improper interpretation of the data. This leads to undefined behavior which may lead to other security-related impacts (data executed as code, service termination, disclosure of sensitive information).

II. Impact

Attackers can exploit this vulnerability remotely to cause a variety of impacts, including denial of service, arbitrary code execution, and disclosure of sensitive information.

III. Solution

Apply the patches made available by your vendor, or upgrade to the recommended version. The "Systems Affected" section contains a list of vendors and details about the status of their products. Clicking on the vendor name will provide you with any statements that the vendor has made.

The OpenSSL team has recently released OpenSSL 0.9.6g to completely remove all known instances of this vulnerability.

Systems Affected

Vendor	Status	Date Updated
Apache	Unknown	9-Aug-2002
Apache-SSL	Unknown	9-Aug-2002
Apple Computer Inc.	Vulnerable	9-Aug-2002
Covalent	Unknown	9-Aug-2002
Debian	Vulnerable	9-Aug-2002
Gentoo Linux	Unknown	9-Aug-2002
Guardian Digital	Vulnerable	9-Aug-2002
Hewlett-Packard Company	Vulnerable	9-Aug-2002
IBM	Vulnerable	9-Aug-2002
ISC	Vulnerable	9-Aug-2002
Juniper Networks	Vulnerable	16-Aug-2002
Lotus Development Corporation	Not Vulnerable	9-Aug-2002
MandrakeSoft	Vulnerable	23-Sep-2002
Microsoft Corporation	Not Vulnerable	26-Sep-2002
NCSA	Unknown	9-Aug-2002
NetBSD	Vulnerable	23-Sep-2002
OpenLDAP	Vulnerable	9-Aug-2002
OpenPKG	Vulnerable	9-Aug-2002
OpenSSL	Vulnerable	9-Aug-2002
Oracle	Vulnerable	10-Aug-2002
Red Hat Inc.	Vulnerable	9-Aug-2002
Secure Computing Corporation	Vulnerable	30-Sep-2002
SuSE	Vulnerable	23-Sep-2002
Trustix	Vulnerable	7-Aug-2002

References

http://www.kb.cert.org/vuls/id/102795
http://www.kb.cert.org/vuls/id/258555
http://www.kb.cert.org/vuls/id/308891
http://www.kb.cert.org/vuls/id/561275
ftp://ftp.openssl.org/source/
ftp://ftp.openssl.org/source/openssl-engine-0.9.6g.tar.gz
ftp://ftp.openssl.org/source/openssl-engine-0.9.6g.tar.gz.asc
ftp://ftp.openssl.org/source/openssl-engine-0.9.6g.tar.gz.md5
http://www.securityfocus.com/bid/5366

Credit

This vulnerability was independently discovered by Adi Stav and James Yonan. Our thanks to Stephen Henson for reporting on this vulnerability.

This document was written by Jason A Rafail and Jeffrey S. Havrilla.

Other Information

Date Public	07/30/2002
Date First Published	07/30/2002 10:14:01 AM
Date Last Updated	09/30/2002
CERT Advisory	CA-2002-23
CVE Name	CAN-2002-0659
US-CERT Technical Alerts
Metric	31.33
Document Revision	32

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader